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June 16, 2008 
(202)454-4691 
saftergood @ fas .org 

Hon. Anna G. Eshoo 
Chairman 

Subcommittee on Intelligence Community Management 
Permanent Select Committee on Intelligence 
U.S. House of Representatives 



Dear Chairman Eshoo: 

Thank you for your June 1 1 letter inviting me to comment on the new White 
House policy regarding "Controlled Unclassified Information" (CUI) and its 
implications for information sharing. 

In summary, I believe that the impulse behind the new policy is sound and that it 
is a matter of some urgency to bring greater uniformity and consistency to the 
handling of unclassified information. 

However, to my disappointment, the new CUI Framework fails to fulfill the 
promise previously expressed that the volume of unclassified information subject 
to official controls would decline. Instead, it runs the risk of turning CUI into 
what amounts to a fourth classification level (i.e., after Top Secret, Secret, and 
Confidential). Furthermore, it is uncertain that the new Framework will succeed 
even on its own limited terms, since it faces both logistical and "cultural" 
obstacles. 

I believe Congress could assist by articulating performance goals, by nurturing 
continued policy development with appropriate resources along with regular 
oversight, and by mandating disclosure of unclassified records that are not or 
should not be controlled. 

Some more detailed observations follow. 
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1 . 



The new CUI Framework is Far From Mature. 



The CUI Framework is a work in progress. Two and a half years after President Bush ordered 
development of a streamlined policy for CUT many of the most difficult policy challenges 
involved have not yet been resolved: What exactly is CUI? Does everything that was formerly 
marked "Sensitive But Unclassified" potentially qualify as CUI? If not, what is excluded? 

The implementing guidance for CUI has not yet been written, and the infrastructure for 
overseeing compliance with the CUI Framework does not exist. 

In other words, we are still near the beginning of the policy development process, not the end. 



2. The CUI Office Lacks Independent Funding. 

The CUI Office at the National Archives has been assigned primary responsibility for developing 
and issuing CUI policy standards and implementation guidance, among other things. But the 
Office does not have its own staff or resources. The CUI Office Director, the very capable 
William J. Bosanko, already has another full-time job as Director of the Information Security 
Oversight Office. 

Funding for the CUI Office is precarious, as well. It has no independent funding for the current 
fiscal year, and has apparently missed the opportunity to request funding for FY 2009. Instead, I 
understand that it is receiving indirect funding support from the ODNI Information Sharing 
Environment. 

This is not a configuration that is likely to command the respect and compliance needed to 
advance the CUI process. 



3. The CUI Framework Faces Profound "Cultural" Obstacles. 

The new CUI policy requires agencies to compromise their autonomy and to function 
collaboratively across jurisdictional boundaries. That is easier said than done. 

In this respect, I believe the CUI Framework may resemble the issue of security clearance 
reciprocity (i.e. the mutual acceptance by agencies of security clearances granted by other 
agencies). Both policies require agencies to subordinate their particular interests to a greater 
government-wide goal. 

Reciprocity has been a declared policy for decades. And yet even today, as you know, it is only 
imperfectly implemented. I think that CUI raises a similar set of challenges to agency "self- 
determination" and like reciprocity it seeks to compel interagency cooperation that would never 
arise spontaneously. Indeed, that is the purpose of the policy. 

This is not an objection to CUI, but merely an observation that the success of the policy is not 
assured, and if it comes, it may take more than a few years. 
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